The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2360 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (9.6.22)

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

    * postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2360 advisory.

  - postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

  - postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1970-1 advisory.

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted     table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from     this vulnerability is to data confidentiality. (CVE-2021-32028)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:0894-1 advisory.

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3481-1 advisory.

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted     table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from     this vulnerability is to data confidentiality. (CVE-2021-32028)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has postgresql packages installed that are affected by a vulnerability:

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
150825	RHEL 8 : postgresql:9.6 (RHSA-2021:2360)	Nessus	Red Hat Local Security Checks	2021/6/16	2024/11/7	high
150840	CentOS 8 : postgresql:9.6 (CESA-2021:2360)	Nessus	CentOS Local Security Checks	2021/6/16	2021/8/19	high
150891	SUSE SLED15 / SLES15 Security Update : postgresql10 (SUSE-SU-2021:1970-1)	Nessus	SuSE Local Security Checks	2021/6/21	2023/7/13	high
151075	openSUSE 15 Security Update : postgresql10 (openSUSE-SU-2021:0894-1)	Nessus	SuSE Local Security Checks	2021/6/28	2021/8/19	high
154321	SUSE SLED12 / SLES12 Security Update : postgresql10 (SUSE-SU-2021:3481-1)	Nessus	SuSE Local Security Checks	2021/10/21	2023/7/13	high
154534	NewStart CGSL CORE 5.04 / MAIN 5.04 : postgresql Vulnerability (NS-SA-2021-0116)	Nessus	NewStart CGSL Local Security Checks	2021/10/27	2021/10/27	high

偵測

搜尋 Plugin

high

high

high

high

high

high